Review DANDI & GitHub log in/out flow & encryption strategy

[kabilar]

No description provided.

[aaronkanzer]

@kabilar Just leaving some notes here in preparation for meeting w/ Roni tomorrow. (left this in a different GitHub Issue by accident -- re-posting here)

Main Technical Goals: 1. Confirm current observed behavior, 2.Discuss next steps where a user truly logs in and logs out.

Log-in/Log-out flow:

• Logout doesn't actually "log" out of the system
• Logout of GitHub does not log out of DANDI
• Support for other OAuth providers -- has that been a conversation prior

Encryption:

• Tokens locally aren't encrypted; they are sent over HTTPS though, so ideally encrypted-in-transit

Just some references of Login/Logout:

Frontend OAuth Client

Backend root configuration for login url